Firefox 2.0.0.11 File Focus Stealing Vulnerability

Carl hardwick posted the following message on the FD Security list earlier today:

Firefox 2.0.0.11 File Focus Stealing vulnerability:

Sorry Mozilla, but the recent file focus fix was not enough. I think Mozilla made another mistake while fixing the previous file/label issue. Because now I embed a file field and a textfield inside one label. When this happens, and you type only one time in the textfield, the focus travels to the file field and the value travels with it.

Back to the drawing board I would say. I only got it to work in Firefox, Gareth checked Safari for me, and it also works in Safari. I guess this type of exploit could function on other HTML objects as well, and could be very dangerous because it only requires a one time focus in a textfield.

PoC here:
http://carl-hardwick.googlegroups.com/web/Firefox20011StealFocusFlaw.htm

---------------------

Firefox 2.0.0.11 was just released yesterday to fix a issue in 2.0.0.10.

Juha-Matti has confirmed on the FD list that Netscape Navigator version 9.0.0.4 on a fully patched Mac OS X 10.4.10 system. He has contacted the vendor.

Some believe that this vulnerability could be found in all gecko based browsers, but one one user on the FD list noted that the PoC didn't work on Mozilla Gran Paradiso 3.0a7.

I guess we should expect another Firefox fix to be in the works....